External risk intelligence

MikroTik RouterOS SSH Argument Handling Privilege Escalation

CVE advisoryKnown Exploit

CVE-2026-86060

The vulnerability exists in the SSH login path of a network router. Routers are frequently deployed at the edge of networks, and SSH management interfaces on these devices are commonly exposed to the internet or wide-area networks for remote administration, making the login path a public-facing service by design.

Privilege Escalation

Mikrotik Routeros

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in RouterOS's SSH login process could allow unauthorized access to change security settings, potentially leading to privilege escalation. This flaw requires an unauthenticated attacker to exploit the login helper functionality.

Flaw allows system control via username.
Critical flaw impacts network router security.
Confirm relevance and exposure to business operations.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted usernames to a router's SSH login. This bypasses security controls, allowing the attacker to modify the router's trusted policy mask. This modification can lead to an attacker gaining elevated privileges on the system.

Unauthenticated SSH session required.
Username triggers argument-handling flaw.
Privilege escalation on the router.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to alter a device's trusted policy, potentially leading to unauthorized changes to its network access controls. This could affect the router's ability to enforce security policies and manage network traffic when an unauthenticated SSH session is possible.

Router policy configurations.
Unauthenticated SSH session.
Unauthorized network access changes.

Operational Fix

Recommended remediation, mitigation, and detection steps

In most organizations, the infrastructure or network team will likely own this vulnerability due to its presence on network routers, with potential involvement from platform or security teams if routers are managed as part of a broader platform. The first practical step is to inventory all RouterOS devices, determine their network exposure and business criticality, and identify the accountable owner for each. Subsequently, a remediation plan should be developed based on the assessed risk, considering vendor coordination and planned maintenance windows.

Infrastructure and security teams own this.
Verify SSH exposure and device criticality.
Plan phased updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MikroTik RouterOS?

RouterOS is the proprietary operating system used on MikroTik networking hardware, such as routers and switches. It functions as the device's control center, managing network traffic, routing protocols, firewall rules, and administrative access. Because it powers the infrastructure connecting local networks to the internet, maintaining the integrity of its management services is essential for network stability and security.

What is the vulnerability in CVE-2026-86060?

This vulnerability is classified as CWE-88, or Argument Injection. It occurs when a system fails to properly sanitize input before passing it to a command or process. In this case, providing a specific, malformed username during the SSH login process causes the system to misinterpret the input. This error allows the software to be tricked into modifying its internal security policy mask, granting the attacker elevated system privileges.

How does an attacker trigger this SSH flaw?

An attacker triggers this flaw by initiating an unauthenticated SSH connection to the router and supplying a specially crafted username string that includes prohibited characters. The vulnerability specifically affects the login helper process during this handshake. If a standard, valid username is used, the argument-handling flaw is not invoked, and the system functions normally.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is very likely to pose a risk because it resides in the SSH login path. Network routers are typically positioned at the edge of a network to manage traffic, and their SSH management interfaces are frequently exposed to the internet or wide-area networks for remote administration. If your router's management interface is reachable from the internet, it is a primary target for this vulnerability.

What should I do to address CVE-2026-86060?

The most effective response is to update your devices to the patched versions provided by the vendor: 6.49.21 (Long-term), 7.23.4 (Long-term), or 7.24.2 (Stable). Before patching, inventory your infrastructure to identify all affected routers. Assess which devices have exposed management interfaces and prioritize those for updates. Coordinate with your network operations team to schedule these installations during a maintenance window to minimize impact on your production traffic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.